ca8b6115e735211e7dbabae9fd7ad592fd144c71eafe53223cfc4b4f7e08ced3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 01:07

Target

e068374e479cfa1cd7cce7f5622f1e30.exe
Size

55KB
MD5

e068374e479cfa1cd7cce7f5622f1e30
SHA1

164b1b4e1af490b42af7a65911725f2777dcd7d5
SHA256

ca8b6115e735211e7dbabae9fd7ad592fd144c71eafe53223cfc4b4f7e08ced3
SHA512

f41f5fe618b14eb97a6f2e3c7a0a4924c9cc0d49470b9b8babd8adfd1509e07a46305cb66f7eae559c74ee43724e24860d4b8299e2206349af5cadf753d23ff4
SSDEEP

768:JQoB5V6CE9wL8CB4c/qQn7KgXNqlfUDXqmLWKEL8gqlQ4M33wWx71Oygl:J7BH69vcyQLX8l8OmLW54gGMvxROygl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2040	2168	e068374e479cfa1cd7cce7f5622f1e30.exe	28
PID 2168 wrote to memory of 2040	2168	e068374e479cfa1cd7cce7f5622f1e30.exe	28
PID 2168 wrote to memory of 2040	2168	e068374e479cfa1cd7cce7f5622f1e30.exe	28
PID 2168 wrote to memory of 2040	2168	e068374e479cfa1cd7cce7f5622f1e30.exe	28

C:\Users\Admin\AppData\Local\Temp\e068374e479cfa1cd7cce7f5622f1e30.exe
"C:\Users\Admin\AppData\Local\Temp\e068374e479cfa1cd7cce7f5622f1e30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 120
  2⤵
  - Program crash
  PID:2040

memory/2168-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download